diff --git a/nixos/lib/testing/network.nix b/nixos/lib/testing/network.nix
index 5caea2710754..2a188e480ecb 100644
--- a/nixos/lib/testing/network.nix
+++ b/nixos/lib/testing/network.nix
@@ -3,15 +3,15 @@
 let
   inherit (lib)
     attrNames
-    concatMap
+    concatMapAttrs
     concatMapStrings
-    flip
     forEach
     head
     listToAttrs
     mkDefault
     mkOption
     nameValuePair
+    optionalAttrs
     optionalString
     range
     toLower
@@ -91,23 +91,22 @@ let
         # interfaces, use the IP address corresponding to
         # the first interface (i.e. the first network in its
         # virtualisation.vlans option).
-        networking.extraHosts = flip concatMapStrings (attrNames nodes) (
-          m':
+        networking.hosts = concatMapAttrs (
+          name: config:
           let
-            config = nodes.${m'};
             hostnames =
               optionalString (
                 config.networking.domain != null
               ) "${config.networking.hostName}.${config.networking.domain} "
               + "${config.networking.hostName}\n";
           in
-          optionalString (
-            config.networking.primaryIPAddress != ""
-          ) "${config.networking.primaryIPAddress} ${hostnames}"
-          + optionalString (config.networking.primaryIPv6Address != "") (
-            "${config.networking.primaryIPv6Address} ${hostnames}"
-          )
-        );
+          optionalAttrs (config.networking.primaryIPAddress != "") {
+            "${config.networking.primaryIPAddress}" = [ hostnames ];
+          }
+          // optionalAttrs (config.networking.primaryIPv6Address != "") {
+            "${config.networking.primaryIPv6Address}" = [ hostnames ];
+          }
+        ) nodes;
 
         virtualisation.qemu.options = qemuOptions;
         boot.initrd.services.udev.rules = concatMapStrings (x: x + "\n") udevRules;
diff --git a/nixos/modules/services/cluster/kubernetes/pki.nix b/nixos/modules/services/cluster/kubernetes/pki.nix
index e4f8cf44e703..0453091fb9b6 100644
--- a/nixos/modules/services/cluster/kubernetes/pki.nix
+++ b/nixos/modules/services/cluster/kubernetes/pki.nix
@@ -365,9 +365,12 @@ in
         keyFile = mkDefault key;
         trustedCaFile = mkDefault caCert;
       };
-      networking.extraHosts = mkIf (config.services.etcd.enable) ''
-        127.0.0.1 etcd.${top.addons.dns.clusterDomain} etcd.local
-      '';
+      networking.hosts = mkIf (config.services.etcd.enable) {
+        "127.0.0.1" = [
+          "etcd.${top.addons.dns.clusterDomain}"
+          "etcd.local"
+        ];
+      };
 
       services.flannel = with cfg.certs.flannelClient; {
         kubeconfig = top.lib.mkKubeConfig "flannel" {
diff --git a/nixos/modules/virtualisation/google-compute-config.nix b/nixos/modules/virtualisation/google-compute-config.nix
index 8f9e2b4f4075..3b6387a3a565 100644
--- a/nixos/modules/virtualisation/google-compute-config.nix
+++ b/nixos/modules/virtualisation/google-compute-config.nix
@@ -70,10 +70,12 @@ in
   # Rely on GCP's firewall instead
   networking.firewall.enable = mkDefault false;
 
-  # Configure default metadata hostnames
-  networking.extraHosts = ''
-    169.254.169.254 metadata.google.internal metadata
-  '';
+  networking.hosts = {
+    "169.254.169.254" = [
+      "metadata.google.internal"
+      "metadata"
+    ];
+  };
 
   networking.timeServers = [ "metadata.google.internal" ];
 
diff --git a/nixos/modules/virtualisation/nixos-containers.nix b/nixos/modules/virtualisation/nixos-containers.nix
index e5a0d37d6a9c..1854a279285d 100644
--- a/nixos/modules/virtualisation/nixos-containers.nix
+++ b/nixos/modules/virtualisation/nixos-containers.nix
@@ -1084,14 +1084,10 @@ in
           ) config.containers;
 
         # Generate /etc/hosts entries for the containers.
-        networking.extraHosts = concatStrings (
-          mapAttrsToList (
-            name: cfg:
-            optionalString (cfg.localAddress != null) ''
-              ${head (splitString "/" cfg.localAddress)} ${name}.containers
-            ''
-          ) config.containers
-        );
+        networking.hosts = lib.mapAttrs' (name: cfg: {
+          name = head (splitString "/" cfg.localAddress);
+          value = lib.optionals (cfg.localAddress != null) [ "${name}.containers" ];
+        }) config.containers;
 
         networking.dhcpcd.denyInterfaces = [
           "ve-*"